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Abstract 

The  Air  Force  has  purchased  its  first  new  generation  of  airlift  aircraft  with  the 
acquisition  of  the  C-17.  More  than  just  replacing  the  C-141  as  the  workhorse  of  the  Air 
Force,  the  C-17  has  also  replaced  part  of  the  crew  with  inertial  navigation  systems, 
computers,  and  automation.  The  reliance  on  the  automation  of  the  C-17  demands  a 
smooth  interface  between  crew  and  automation,  the  crew  must  stay  informed  of  the 
progress  of  the  systems,  and  remain  prepared  to  assume  manual  control  should  the 
automation  fail.  To  accomplish  this,  the  automation  must  be  designed  for  ease  of  use  and 
the  crew  must  be  trained  to  work  in  harmony  with  each  other  and  the  automation. 

Each  aircraft  manufacturer  has  a  particular  philosophy  about  how  its  aircraft  are 
automated,  and  each  aircraft  operator  has  a  philosophy  about  operating  those  aircraft.  An 
understanding  of  these  philosophies  and  the  knowledge  of  problems  associated  with 
automation  are  valuable  tools  for  pilots.  This  paper  will  discuss  those  philosophies, 
including  the  philosophies  of  the  design  and  operation  of  the  C-17. 

Fortunately,  civilian  aviation  has  had  over  ten  years  of  experience  dealing  with  the 
many  intricacies  of  these  highly  automated  aircraft.  Pilot  reports  and  academic  research 
have  identified  specific  problems,  or  pitfalls  associated  with  automated  aircraft.  This 
paper  presents  pitfalls  to  be  avoided  by  Air  Force  operators. 
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AUTOMATED  COCKPIT  TECHNOLOGIES: 


IMPLICATIONS  FOR  AIR 
MOBILITY  COMMAND  AIRCREWS 


I.  Introduction 


General  Issue 

In  no  endeavor  has  technology  been  brought  to  bear  more  effectively  than  in  the 
aviation  profession,  and  no  profession  has  more  effectively  stimulated  the  advance  of 
technology.  In  less  than  one  hundred  years  we  have  moved  from  the  first  flight  of  the 
Wright  brothers  to  transporting  hundreds  of  people  and  tons  of  cargo  in  aircraft  utilizing 
the  latest  advances  of  computer  technology.  In  the  course  of  this  development  process, 
we  have  learned  how  to  automate  nearly  the  entire  process  of  flying.  But  have  we  gone 
too  far?  When  does  the  pilot  become  a  redundant  component  to  the  automation? 

The  civilian  airline  industry  led  the  way  with  the  two-pilot  cockpit  concept.  The 
latest  aircraft  from  Boeing,  McDonnell  Douglas,  and  Airbus  are  all  highly  automated, 
two-person  cockpits.  Many  airlines  are  currently  flying  these  aircraft  with  great  success 
and  the  military  has  just  begun  operating  its  first  advanced  technology  heavy  airlift 
aircraft.  But  how  much  of  what  civihan  aviation  has  learned  will  adapt  to  the  inherently 
distinct  missions  of  military  aviation? 
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Problem  Statement 


Recently,  the  Air  Force  published  operating  policies  on  the  use  of  automation  in 
Multi-Command  Instruction  (MCI)  11-217,  Volume  5.  This  document  provides  excellent 
information  to  the  crews  flying  the  C-17,  but  there  is  additional  information  available 
from  research  and  civilian  airline  operations  to  further  benefit  aircrew  flying  highly 
automated  aircraft.  This  paper  consolidates  that  information  to  further  an  understanding 
toward  operating  the  C-17  and  future  highly  automated  aircraft. 

Research  Objective 

The  objective  of  this  paper  is  to  discuss  the  design  philosophies  of  automated 
aircraft.  Philosophies  are  addressed  from  the  design  perspective  as  well  as  from  the  view 
of  the  companies  operating  highly  automated  aircraft.  This  paper  includes  a  discussion  of 
unanticipated  dangers,  or  pitfalls,  associated  with  automated  aircraft.  Understanding 
pitfaUs  previously  identified  by  accident/incident  investigation  and  research  will  prove  a 
valuable  asset  to  any  operator.  A  final  objective  of  this  paper  is  to  reconunend  operating 
policies  for  inclusion  to  Air  Force  operating  instructions. 

Research  Questions 

This  paper  addresses  the  following  research  questions: 

1.  How  can  the  Air  Force  improve  operating  philosophies  provided  to  C-17  crews? 

To  fully  develop  this  answer,  the  following  questions  will  be  addressed: 

2.  What  is  automation  philosophy  and  why  is  it  important? 


2 


3.  What  are  the  philosophies  of  aircraft  designers? 

4.  What  are  the  philosophies  of  airline  companies? 

5.  What  are  some  of  the  potential  pitfalls  associated  with  automated  aircraft  today? 

This  paper  addresses  these  questions  through  a  discussion  about  what  a 
philosophy  is,  and  how  it  relates  with  the  policies  and  procedures  of  design  and 
operations.  Individual  aircraft  manufacturer  and  airline  philosophies  are  presented  with  a 
discussion  about  some  of  the  pitfalls  encountered  in  operating  these  highly  automated 
aircraft.  Included  in  this  discussion  will  be  the  design  and  implementation  of  automation 
in  the  C- 17.  This  paper  concludes  with  reconunendations  to  existing  Air  Force  policies 
about  operating  the  C-17. 
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II.  Automation 


Automation  is  a  technology  that  works  best  in  predetermined  situations  such  as 
those  which  can  be  planned  and  programmed  ahead  of  time.  Technology  does  not  always 
provide  quick  and  easy  flexibility  when  the  external  situation  changes.  Christopher 
Wickens,  a  noted  industrial  psychologist,  says  automation  should  be  used  to  perform 
functions  that  the  human  operator  either  cannot  perform,  performs  poorly,  or  in  which  the 
human  operator  shows  limitations  (Wickens,  1992,  p.  531). 

The  introduction  of  automation  to  the  cockpit  of  current  aircraft  has  greatly 
benefited  aviation.  Today's  pilot  has  available  at  his  fingertips  more  information  than 
could  be  carried  in  even  the  largest  map  case.  However,  without  proper  guidance,  this 
information  is  of  little  use,  and  used  inappropriately  it  could  be  disastrous.  Degani  and 
Wiener  (1994)  point  out  that  to  operate  a  complex  system  successfully,  the  human- 
machine  system  must  be  supported  by  an  organizational  infrastructure  of  operating 
concepts,  rules  and  guidelines.  There  cannot  be  a  procedure  for  everything,  and  the  time 
will  come  when  the  operators  of  a  complex  system  face  a  unique  situation  for  which  there 
is  no  procedure.  It  is  at  this  point  that  we  recognize  the  reason  for  keeping  humans  in  the 
system,  since  automation,  with  all  its  advantages,  is  merely  a  set  of  coded  procedures 
executed  by  the  machine.  Nowhere  is  there  a  more  dramatic  example  of  human  ingenuity 
than  the  United  Airlines  DC-10  that  crashed  in  Sioux  City  on  July  19, 1989.  Government 
investigators  determined  that  the  plane  crashed  because  a  metal  fan  disk  in  the  tail  engine 
broke  up  in  flight  and  metal  shards  severed  all  the  hydraulic  lines  that  controlled  the 
plane's  steering  system .  When  the  pilot  regained  aircraft  control  he  turned  to  the  flight 
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engineer  and  asked  what  was  the  procedure.  The  engineer’s  reply  was:  “There  is  none” 
(Degani,  1994).  Only  human  ingenuity,  good  crew  resource  management  skills,  and  a 
little  luck  saved  184  of  the  296  people  on  board  when  the  plane  crashed  on  a  runway  in 
Iowa.  Attachment  1  contains  a  synopsis  of  additional  aircraft  incidents/accidents  that 
have  been  attributed  to  aircraft  automation. 

Philosophy,  Policies  and  Procedures 

A  philosophy  is  a  system  of  beliefs  or  a  doctrine  that  includes  the  critical  study  of 
the  basic  principles  for  guidance  in  practical  affairs  (Palmer,  et  al.,  1995).  Automation 
philosophy  can  be  defined  as  the  over-arching  view  of  how  automation  should  be  utilized 
in  an  aircraft.  There  is  a  philosophy  toward  the  development  of  the  system  itself  as  well 
as  a  philosophy  toward  the  operation  of  that  system.  Company  philosophy  is  largely 
influenced  by  the  individual  philosophies  of  the  top  decision  makers.  They  should  be 
complementary  to  each  other,  but  sometimes  they  are  not.  An  airline  manager  may  not  be 
able  to  clearly  state  his  airline’s  philosophy,  but  a  philosophy  does  exist  and  can  be 
inferred  from  procedures,  policies,  training,  and  punitive  actions  (Degani  and  Wiener, 
1994,  p.  49). 

The  emergence  of  flight  deck  automation  as  an  operational  problem  has  generated 
an  interest  in  the  philosophy  of  operations,  partly  due  to  lack  of  agreement  about  how  and 
when  automatic  features  are  to  be  used,  and  who  makes  the  decision,  the  company  or  the 
pilot  in  command.  The  unlimited  capability  of  today’s  Flight  Management  Systems 
(FMS)  to  operate  between  any  range  of  fully  automated  to  manual  control  has  convinced 
some  airlines  that  it  is  necessary  to  formally  state  a  company  philosophy  of  operational 
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utilization  of  automation.  However,  this  philosophy  must  allow  a  pilot  the  freedom  to 
improvise,  as  no  philosophy  can  address  every  issue  a  pilot  will  encounter. 

Policies  are  plans,  or  courses  of  action,  that  will  dictate  what  the  company  expects 
on  the  line.  Policies  are  developed  to  adhere  to  the  primary  operating  philosophy. 

Policies  are  broad  specifications  of  the  manner  in  which  management  expects  operations 
to  be  performed  (training,  flying,  exercise  of  authority,  personal  conduct,  etc.)  (Degani 
and  Wiener,  1994).  Procedures,  then,  are  more  exact  actions  or  methods  used  to  carry  out 
the  stated  philosophy  of  the  company.  Procedures  should  be  designed  to  be  as  consistent 
as  possible  with  the  poUcies  (which  are  consistent  with  the  philosophy).  This  structure  is 
depicted  in  Figure  2.  Procedures  will  dictate  specific  actions  to  the  pilots,  but  an 
understanding  of  the  designer’s  philosophy  behind  the  development  of  the  automation 
will  provide  the  pilot  with  the  flexibility  to  confront  those  situations  which  are  not 
addressed  by  procedure. 


Figure  1:  The  Three  Ps  (Degani  and  Wiener,  1994,  p.  50) 
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Standard  operating  procedures  (SOPs)  are  sets  of  procedures  that,  apart  from 
being  merely  specifications  of  tasks,  also  serve  to  provide  a  common  ground  for  a  flight 
crew  which,  at  times  may  be  totally  unfamiliar  with  each  other’s  experience  and  technical 
capabilities  (Degani  and  Wiener,  1994,  p.  48).  The  airline  industry  is  a  strong  proponent 
of  SOPs.  Airlines  attempt  to  attain  a  level  of  standardization  such  that  if  a  cockpit 
crewmember  were  to  be  replaced  in  mid-flight  the  operation  would  continue  safely  and 
smoothly.  While  SOPs  promote  uniformity  of  operations  among  large  groups,  they  do  so 
at  the  risk  of  reducing  the  role  of  the  human  operator  to  a  lower  level  (Degani  and 
Wiener,  1994).  When  systems  operators  are  reduced  to  the  role  of  systems  monitors, 
complacency  is  often  mentioned  as  a  potential  negative  effect  (Parasuraman,  Molloy,  and 
Singh,  1993).  The  system  designer  must  recognize  this,  and  design  systems  to  exploit  the 
most  valuable  asset  in  the  system,  the  operator.  Further,  it  is  important  for  management 
to  provide  consistent  and  technically  correct  procedures,  which  in  turn  will  ensure  the 
economical  utilization  of  both  humans  and  equipment,  and  the  safe  conduct  of  flight. 

Any  procedure,  even  the  best  one,  can  not  be  error  proof.  The  role  of  airhne  management 
is  to  provide  the  best  possible  baseline  for  its  crews,  and  then  train  and  standardize  to  this 
baseline  (Degani  and  Wiener,  1994,  p.  65).  No  procedure  is  a  substitute  for  an  intelhgent 
operator. 

Human-Centered  Aviation 

One  design  philosophy  that  is  gaining  momentum  in  the  aviation  industry  is 
Human-Centered  Aviation.  This  philosophy,  developed  by  Dr.  Charles  E.  Billings  of 
Ohio  State  University,  recognizes  that  today’s  aircraft  are  not  always  designed  to 
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facilitate  effective  cooperation  between  the  pilot  and  the  machine  (BiUings,  1996).  Until 
now,  the  philosophy  of  adding  automation  to  the  cockpit  seems  to  be:  if  it  can  be 
automated,  do  it.  According  to  Dr.  Billings,  over  time  this  has  had  the  effect  of  making 


the  flight  crew  more  peripheral  to  the  actual  operation  of  the  aircraft  (see  Figme  2). 


Increasing  Complexity,  Decreasing  Direct  Pilot  Control 


Figure  2:  Trends  in  Aircraft  Automation  (Billings,  1996,  p.  6) 


Dr.  Billings  notes  that  the  progress  of  automation  technology  will  continue  to 
accelerate  during  the  next  decade.  For  this  reason,  it  is  essential  that  designers  have  a 
clear  understanding  of  the  effects  of  these  systems  on  the  human  operator.  The  concept 
of  “human-centered”  automation  is  an  attempt  to  design  the  system  beginning  with  the 


8 


human  and  developing  tools  and  artifacts  specifically  to  complement  the  pilot’s 
capabilities. 

No  one  questions  the  necessity  for  operator  involvement  in  flight  operations,  but 
Dr.  Billings  contends  that  too  little  involvement  will  cause  the  pilot  to  lose  situational 
awareness,  and  when  required  to  assume  manual  control  due  to  a  failure  in  the 
automation,  the  pilot  will  not  be  able  to  respond  in  either  an  appropriate  or  timely 
manner.  The  current  pattern  of  aircraft  design  is  one  in  which  the  pilots  either  do  not 
understand  what  the  automation  is  doing  or  do  not  receive  adequate  feedback  from  the 
automated  systems  (Hughes,  et.  al,  Jan,  1995,  p.  52).  Billings  recommends  system 
designers  incorporate  an  active  role  for  the  pilot.  This  may  involve  any  or  all  of 
complete,  active  control,  decision-making  toward  allocation  of  resources,  or  evaluation  of 
alternatives. 

Other  principle  features  of  Human-Centered  Aviation  include: 

•  Keeping  the  pilots  informed  of  automated  actions 

•  Automated  systems  must  be  predictable 

•  Automated  systems  must  be  able  to  monitor  the  human  operator 

Dr.  Billings  sums  up  his  discussion  about  human-centered  automation  by  pointing 
out  that  although  humans  are  far  from  perfect  sensors,  decision-makers  and  controllers, 
they  possess  three  invaluable  attributes.  They  are  excellent  detectors  of  signals  in  the 
midst  of  noise,  they  can  reason  effectively  in  the  face  of  uncertainty,  and  they  are  capable 
of  abstraction  and  conceptual  organization  (Billings,  1996,  p.  13).  Humans  therefore 
provide  to  the  aviation  system  a  degree  of  flexibility  that  cannot  now,  and  may  never,  be 
attained  by  computers. 
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III.  Designers*  Philosophy 


Every  aircraft  designer  has  a  different  overriding  philosophy  concerning  what  can 
and  should  be  automated.  That  philosophy  is  the  result  of  a  combination  of  higher  level 
corporate  guidance,  how  previously  produced  aircraft  were  automated,  and  the 
availability  of  technology  to  automate  the  desired  function,  as  well  as  access  to  that 
technology.  As  in  all  business  decisions,  cost  is  always  a  major  factor. 

The  FAA  recently  commissioned  a  Human  Factors  (HF)  Team  to  report  on 
interfaces  between  flightcrews  and  automated  aircraft.  The  study.  Interfaces  Between 
Flightcrews  and  Modem  Flight  Deck  Systems,  is  the  result  of  observations  and  interviews 
with  aircraft  manufacturers,  airline  representatives,  pilots’  associations,  and  researchers 
from  various  aviation  organizations  (Abbott,  et  al,  1996).  The  Human  Factors  team 
recommends  areas  that  should  be  addressed  by  the  FAA  and  gives  guidance  to  aircraft 
designers  and  operators  to  improve  man-machine  interface. 

Management  of  Automation 

The  Human  Factors  team  report  expressed  a  concern  about  two  major  issues 
regarding  automation;  pilot  understanding  of  the  automation  and  differing  pilot  decisions 
about  the  appropriate  automation  level  to  use. 

First,  the  team  observed  and  was  briefed  by  pilots  themselves  that  too  often  pilots 
are  surprised  by  the  actions  of  automation  in  their  aircraft.  Flightcrews  often  are  faced 
with  questions  such  as,  “Why  did  it  do  that?,”  “What  is  it  doing  now?”  and  “What  will  it 
do  next?”  The  team  found  that  some  of  the  automation  surprises  reflect  an  incomplete 
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understanding  of  either  the  automation’s  capabilities  and  limitations,  its  intended  use  or 
the  aircraft’s  display  annunciation  (Abbott,  1996,  p.  33). 

The  HF  team  found  differing  views  regarding  training  for  automation.  Some 
views  held  that  flightcrews  should  be  relieved  of  the  burden  of  fully  understanding 
system  operation  or  the  system’s  underlying  design  philosophy  (Abort,  1996,  p.33).  This 
view  would  ultimately  lead  to  a  training  philosophy  in  which  flightcrews  are  trained  to 
respond  primarily  in  a  rote  manner  (i.e.,  standard  operating  procedures).  While  it  is 
recognized  that  the  use  of  standard  operating  procedures  (SOPs)  is  an  effective  strategy 
for  managing  error,  the  report  states: 

It  is  important  for  flightcrews  to  understand  the  principles  and  assumptions 
embodied  in  the  automation  design  that  affect  safe  operational  use,  especially 
where  these  principles  and  assumptions  may  differ  from  those  of  the  flightcrew. 

In  the  absence  of  this  understanding,  flightcrews  are  likely  to  substitute  their  own 
model  of  how  the  automation  works,  based  on  their  observations  and  assumptions 
of  automation  behavior”.  (Abbott,  1996,  p.  34) 

Instances  where  the  flightcrew’ s  model  is  incomplete  or  incorrect  could  lead  to  confusion 

and  increase  the  potential  for  error.  In  critical  circumstances,  such  confusion  can  lead  to 

a  hazardous  situation  or  at  least  make  it  difficult  for  the  crew  to  respond  in  an  appropriate 

manner. 

The  HF  team  recommends  flightcrews  be  trained  in  the  underlying  principles  of 
the  system’s  design  leaving  some  of  the  details  to  individual  good  operating  practice  or 
technique.  Based  on  the  HF  report,  the  FAA  should  provide  clear  and  concise  guidance 
on: 
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•  Examples  of  circumstances  in  which  the  autopilot  should  be  engaged, 
disengaged,  or  used  in  a  mode  with  greater  or  lesser  authority; 

•  The  conditions  under  which  the  autopilot  or  autothrottle  will  or  will  not  engage, 
will  disengage,  or  wiU  revert  to  another  mode;  and 

•  Appropriate  combinations  of  automatic  and  manual  flight  path  control  (e.g., 
autothrottle  engaged  with  the  autopilot  off). 

While  most  of  this  information  may  be  found  scattered  throughout  several  training 
volumes,  the  HF  team  reconunended  clear  and  concise  guidance  to  promote  better 
flightcrew  understanding  of  the  capabilities  and  limitations  of  the  automation.  Where 
possible  this  guidance  should  include  practical  demonstrations  of  use  during  training. 
Practical  examples  are  intended  to  demonstrate  particular  cases  where  safety  can  be 
improved  by  appropriate  automation  choices. 


Pilot  Decisions 

The  team  found  that  “flightcrews  differ  in  use  of  automation  when  responding  to 
an  abnormal  situation,  and  more  importantly,  crews  may  react  in  ways  not  foreseen  or 
taken  into  account  during  the  design,  certification,  training,  and  procedure  development 
for  highly  automated  airpleines”  (Abbott,  1996,  p.  34).  Observations  by  the  HF  team 
include  situations  where  crews  have  either  inappropriately  continued  to  use  the 
automation  when  in  an  abnormal  situation  or,  if  the  automation  was  initially  off,  turned 
the  automation  on  to  try  to  accomplish  a  recovery.  The  report  included  specific 
examples: 

•  Fixation  on  following  the  flight  director  and  ignoring  airplane  attitude.  In  one 
particular  case,  this  resulted  in  a  low  speed  excursion,  after  which  the  flightcrew 
engaged  the  autopilot  to  accomplish  the  recovery. 

•  Using  the  autopilot  to  recover  from  an  overspeed  warning  rather  than  resorting  to 
manual  control. 
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•  Attempts  by  the  flightcrew  to  engage  the  autopilot  in  the  moments  preceding  the 
March,  1995,  crash  of  a  Tarom  A3 10  at  Bucharest  as  they  attempted  to  recover 
from  an  extreme  bank  angle  resulting  from  a  large  thrust  asymmetry. 

•  Engagement  of  the  autopilot  by  the  flightcrew  of  the  A300-600  that  crashed  at 
Nagoya,  Japan  in  April,  1994  -  apparently  in  response  to  difficulties  in 
maintaining  the  glide  slope  following  the  inadvertent  activation  of  the  takeoff/go- 
around  levers. 

The  team  hypothesized  that  the  action  of  engaging  the  autopilot  to  attempt  to  recover  an 
unrecognized  situation  shows  that  flightcrews  are  becoming  less  confident  in  their  own 
airmanship  skills  relative  to  the  capabilities  they  perceive  to  be  present  in  the  automation, 
particularly  in  a  stressful  situation.  In  some  cases,  where  this  perception  of  the 
automation’s  capabilities  is  particularly  inaccurate,  it  can  have  potentially  hazardous 
consequences. 

The  FAA  report  noted  weaknesses  in  several  areas  relative  to  current  practices  for 
developing  and  implementing  standard  operating  procedures.  Since  a  strong  link  exists 
between  procedural  deficiencies  and  airplane  accidents  it  is  important  to  address  this 
issue.  The  HF  Team  noted  particular  concern  about  the  following  types  of  procedures: 

•  Procedures  used  by  operators  that  are  inconsistent  or  conflict  with  the  airplane 
manufacturer’s  design  philosophy  and  recommended  procedures  (e.g.,  not  using 
autobrakes,  flight  directors,  or  other  systems/features  as  designed); 

•  Procedures  that  are  used  as  a  work-around  for  design  deficiencies  (e.g.,  flightcrew 
call-out  of  mode  changes  as  a  primary  means  for  providing  mode  awareness; 
forbidding  programming  the  FMS  below  a  certain  altitude); 

•  Procedures  that  are  not  covered  adequately  in  training  (e.g.,  use  of  FMS  vertical 
flight  path  modes); 

•  Procedures  or  procedural  steps  that  do  not  promote  understanding  of  the  action(s) 
that  the  flightcrew  are  to  undertake,  especially  for  procedural  items  that  do  not 
appear  to  be  directly  related  to  the  desired  objective  (e.g.,  consequences  of 
activating  or  not  activating  the  approach  mode  on  certain  FMS  systems  and  the  use 
of  FMS  one-engine-inoperative  driftdown  procedures); 

•  Incomplete  consideration  of  the  potential  for  errors  and  the  resulting  hazards, 
especially  when  using  the  procedures  under  varying  circumstances  (e.g., 
inappropriate  use  of  the  open  descent  mode  at  low  altitude,  changing  FMS  arrival 


13 


runway  information,  and  inadvertent  deletion  of  intermediate  route  or  altitude 
constraints); 

•  Procedures  carried  over  from  one  airplane  type  to  another  for  standardization 
purposes,  but  could  have  unintended  consequences  or  are  otherwise  inappropriate 
for  the  different  airplane  type  (e.g.,  not  using  autobrake  capabiUty  for  rejected 
takeoffs  or  not  using  flight  director  information  when  it  is  readily  available  and 
suitable  for  the  task). 

Summarizing  the  HF  Team  report,  the  aviation  system  is  safe,  but  vulnerabilities 
in  the  flightcrew/automation  interface  exist,  especially  in  the  area  of  flightcrew 
management  of  automation  and  situation  awareness.  These  vulnerabilities  appeared  to 
exist  to  varying  degrees  across  the  current  fleet  of  transport  category  airplanes,  regardless 
of  the  manufacturer,  the  operator,  or  whether  accidents  have  occurred  in  a  particular 
airplane  type. 

The  1996  FAA  Human  Factors  report  contributes  recommendations  that  expand 
on  the  philosophy  of  human-centered  aviation  developed  by  Dr.  Billings.  The  FAA  and 
aircraft  designers  and  operators  would  be  wise  to  adopt  these  recommendations.  Today, 
the  three  main  aircraft  producers.  Airbus,  Boeing,  and  McDonnell  Douglas,  possess  three 
different  design  philosophies.  Two  of  these  philosophies  are  similar  to  each  other,  but 
one.  Airbus,  is  very  different. 


Airbus  Philosophy 

Airbus  Industrie  officials  believe  that  if  the  technology  exists  to  automate  a 
function  that  would  prevent  a  pilot  from  inadvertently  exceeding  safety  limits,  this  should 
be  done  (Hughes,  et.  al,  Jan,  1995,  p.54).  Airbus’  design  philosophy  on  file  with  the  FAA 
is; 
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•  Automation  must  not  reduce  overall  aircraft  reliability;  it  should  enhance  aircraft 
and  systems  safety,  efficiency  and  economy. 

•  Automation  must  not  lead  the  aircraft  out  of  the  safe  flight  envelope  and  it  should 
maintain  the  aircraft  within  the  normal  flight  envelope. 

•  Automation  should  allow  the  operator  to  use  the  safe  flight  envelope  to  its  full 
extent,  should  this  be  necessary  due  to  extraordinary  circumstances. 

•  Within  the  normal  flight  envelope,  the  automation  must  not  work  against  operator 
inputs,  except  when  absolutely  necessary  for  safety.  (Bluecoat  newsgroup,  1997) 

Airbus  fly-by-wire  aircraft  have  “hard”  speed  envelope  protection  features.  An 
Alpha  floor  function  prevents  a  pilot  from  stalling  the  Airbus.  When  a  maximum  angle 
of  attack  is  reached,  the  autothrottle  system  will  automatically  select  go-around  power 
and  command  a  pitch  down,  regardless  of  pilot  inputs.  This  unconunanded,  and  often 
unexpected  maneuver  has  resulted  in  at  least  two  crashes  in  France,  an  A320  flyover 
demonstration  in  Habsheim,  and  an  A330  test  flight  at  Toulouse  (Billings,  1996).  A 
second  “hard”  envelope  limits  the  pilot  to  no  more  than  2.5g  in  any  circumstances,  even 
an  emergency.  This  is  a  concern  to  some  pilots  who  fly  these  aircraft.  One  never  knows 
when  the  situation  will  exist  that  the  difference  between  the  2.5g  hmit  and  the  3.0g 
needed  could  be  the  difference  between  hitting  the  other  aircraft/mountain  and  popping  a 
few  rivets  loose  in  an  avoidance  maneuver.  Further,  the  Airbus  A320  has  independent 
side-stick  controllers  and  throttles  that  don’t  move  when  the  autothrottle  system  is 
engaged.  The  independent  side  stick  controllers  further  impede  one  pilot  from  observing 
direct  aircraft  inputs  of  the  other  pilot.  Dr.  Charles  Billings  has  reported  that  this  lack  of 
tactile  feedback  on  A320  control  systems  has  evoked  “fairly  widespread  concern”  in  the 
industry  (Hughes,  et.  al,  1992,  p.  51).  Pilots  prefer  to  be  kept  informed  of  what  the 
aircraft  is  doing  and  to  let  decision  processes  be  left  to  them,  not  the  engineers  in  a 
laboratory. 
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Some  researchers  and  pilots  believe  that  some  Airbus  systems  are  over-automated. 
Previous  discussions  about  accidents/incidents  in  this  paper  point  to  examples  of  these 
claims.  An  experienced  pilot  conunented  that  the  A320  cockpit  design  tends  to  isolate 
the  pilot  from  the  control  loop,  providing  insufficient  feedback  and  stimulating  an 
inappropriate  sense  of  security  (Bluecoat  Newsgroup,  1997).  Based  on  conversations 
with  many  other  pilots,  he  is  not  alone. 

However,  Pierre  Baud,  Airbus  Industrie  senior  vice  president-training,  contends 
“Airbus  transport  glass  cockpits  are  not  over-automated;  we  only  proved  to  be  more 
imaginative  [than  the  competition]  in  applying  available  technology”  (Hughes,  et.  al,  Jan, 
1995,  p.  62).  Bernard  Ziegler,  Airbus  senior  vice  president  of  engineering,  attributed  the 
Nagoya,  Japan  A300-600  accident  and  the  A3 10  incident  in  Moscow  to  the  flight  crew 
fighting  against  the  autopilot  (Hughes,  et.  al,  Jan,  1995,  p.  53).  Ziegler  claimed  that 
Airbus  never  expected  both  the  pilot  and  autopilot  to  be  flying  the  airplane  at  the  same 
time.  If  the  pilot  is  not  satisfied  with  what  the  autopilot  is  doing,  Ziegler  expects  the  pilot 
to  disconnect  the  autopilot  and  fly  manually. 

Boeing  Philosophy 

Boeing  has  a  different  philosophy  that  automation  is  a  tool  to  aid  pilots  and  should 
not  be  given  authority  to  override  pilot  inputs.  As  stated  to  the  FAA,  Boeing’s 
philosophy  on  automation  is: 

•  The  pilot  is  the  final  authority  for  the  operation  of  the  airplane. 

•  Both  crew  members  are  ultimately  responsible  for  the  safe  conduct  of  the  flight. 

•  Hight  crew  tasks,  in  order  of  priority,  are:  safety,  passenger  comfort,  and 
efficiency. 
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•  Design  for  crew  operations  based  on  pilot's  past  training  and  operational 
experience. 

•  Design  systems  to  be  error  tolerant. 

•  The  hierarchy  of  design  alternatives  is:  simplicity,  redundancy,  and  automation. 

•  Apply  automation  as  a  tool  to  aid,  not  replace,  the  pilot. 

•  Address  fundamental  human  strengths,  limitations,  and  individual  differences  -  for 
both  normal  and  non-normal  operations. 

•  Use  new  technologies  and  functional  capabilities  only  when: 

*  They  result  in  clear  and  distinct  operational  or  efficiency  advantages,  and 

*  There  is  no  adverse  effect  to  the  human-machine  interface. 

(Bluecoat  Newsgroup,  1997) 

This  philosophy  is  adhered  to  in  the  newest  Boeing  aircraft,  the  777.  The  777 
incorporates  a  “soft”  protection  system  which  requires  the  pilot  to  apply  more  force  on 
the  control  yoke  when  exceeding  35°  of  bank  and  when  pulling  the  yoke  back  as  the 
aircraft  decelerates  below  minimum  maneuver  speed  (Hughes,  et.  al,  Jan,  1995,  p.54). 
The  changing  control  input  requirements  warn  the  pilot  of  a  high  bank  angle  or  an 
approach  to  stall,  but  the  pilot  still  has  access  to  the  full  performance  envelope  if  needed. 


McDonnell  Douglas  Philosophy 

The  McDonnell  Douglas  philosophy  of  automating  the  MD-11  is,  if  it  can  be 
automated,  automate  it,  but  keep  the  crew  informed  and  maintain  the  ability  for  the  pilots 
to  take  over  manually  if  they  so  desire  (Hughes,  et.  al,  1992,  p.  58).  By  keeping  the  pilot 
in  the  loop,  Douglas  engineers  ensured  pilot  situational  awareness.  McDonnell  Douglas 
has  a  very  simple  philosophy  on  file  with  the  FAA:  “Use  technology  to  assist  the  pilot 
naturally,  while  giving  the  pilot  the  final  authority  to  override  the  computer  and  use  skill 
and  experience”  (Bluecoat  Newsgroup,  1997). 

A  “soft”  protection  system  similar  to  that  of  Boeing  is  found  on  the  MD-1 1. 
However,  the  MD-1 1  design  gives  a  large  amount  of  authority  to  automatic  controllers 
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that  manage  the  fuel,  electrical,  hydraulic  and  pneumatic  systems.  These  systems  are 
usually  run  by  two  computers  which  automatically  troubleshoot  and  reconfigure  the 
systems  to  restore  as  much  of  the  functions  as  possible  (Hughes,  et.  al,  1992,  p.  58). 

Pilots  have  expressed  a  preference  for  the  intuitive  format  of  the  MD-1 1  systems  displays. 

C-17  Design  Philosophy 

The  C-17  is  a  McDonnell  Douglas  product  and  is  similar  in  design  philosophy  to 
the  MD-1 1.  However,  according  to  Bill  Casey,  C-17  chief  pilot  for  McDonnell  Douglas, 
the  company  intentionally  diverged  from  the  commercial  cockpit  designs  to  resolve 
concerns  about  the  lower  experience  levels  of  military  pilots  compared  to  civilian,  and  the 
requirement  to  fly  more  complicated  missions,  including  combat  (Hughes,  et.  al,  Feb, 
1995,  p.  54).  Also,  although  the  C-17  is  a  very  new  aircraft,  the  initial  design 
specifications  were  completed  nearly  25  years  ago.  When  in  the  design  phase,  the  plans 
utilized  front-line  technology.  However,  political  and  financial  constraints  delayed  the 
program,  and  when  the  C-17  finally  made  it  through  production,  the  front-line 
technologies  of  1978  were  antiquated.  The  cockpit  displays  are  a  clear  example  of  this, 
the  C-17  has  cathode  ray  tubes,  compared  with  active  matrix  liquid  crystal  displays  in  the 
Boeing  111  and  more  recently  designed  aircraft  (Hughes,  et.  al,  Jan,  1995,  p.  54). 

Casey’s  view  is  that  the  civil  world  automates  all  the  standard  functions  and  the 
pilots  exercise  management  by  exception.  Instead  of  automated  high  technology,  the  C- 
17  used  the  Lincoln  Logs,  or  a  simplified,  “dumb”  cockpit  approach  (Hughes,  et.  al,  Feb, 
1995,  p.  54).  In  this  approach  Casey  says,  “if  you  don’t  know  what  it  does,  don’t  touch  it, 
and  it  won’t  do  anything.”  This  philosophy  permits  sequential  learning.  The  automation 
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functions  are  easy  for  an  inexperienced  pilot  to  learn  quickly,  and  as  the  pilot  gains  more 
experience  and  becomes  more  comfortable,  he  can  gradually  take  on  the  more  advanced 
capabilities.  The  down  side  to  this  philosophy,  and  a  conscious  trade-off  by  the  military, 
is  that  an  expert  in  the  C- 17  cockpit  will  have  to  push  more  buttons  to  command  a 
specific  action  than  his  airline  counterpart  (Hughes,  et.  al,  Feb,  1995,  p.  54). 
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IV.  Operations  Philosophies 


Some  airlines  proeure  aircraft  from  only  one  manufacturer,  but  most  airlines  fly  a 
variety  of  aircraft  from  different  manufacturers  based  on  the  capacity  criteria  of  the  route 
that  the  aircraft  will  service.  Different  design  philosophies  have  resulted  in  pilots 
encountering  problems  transitioning  from  one  aircraft  manufacturer  to  another.  For 
example,  the  autopilot  disconnect  systems  in  the  Airbus  A300  and  A3 10  are  significantly 
different  than  the  discotmect  systems  provided  in  other  large  transport-category  airplanes 
(Hughes,  et.  al,  Jan,  1995,  p.  60).  This  difference  may  have  contributed  to  the  loss  of  the 
A300  in  Nagoya,  Japan  in  1991.  The  Flight  Data  Recorder  (FDR)  showed  the  pilot  had 
manually  intervened  to  counter  the  autopilot.  This  action  in  a  Boeing  or  McDonnell 
Douglas  type  aircraft  would  have  disconnected  the  autopilot,  but  in  the  A300,  the 
autopilot  remains  engaged.  Further,  the  autopilot  countered  the  inputs  of  the  pilot, 
eventually  resulting  in  loss  of  aircraft  control.  Appendix  1  contains  the  Nagoya  accident 
as  well  as  other  examples  of  automation  incidents/accidents. 

One  constraint  to  an  airlines  operating  philosophy  is  company  executives,  who 
spend  milUons  of  dollars  obtaining  these  expensive  aircraft,  expect  to  reap  a  benefit  from 
their  purchase.  This  expectation  sometimes  trickles  down  to  the  line  crewmember  as  a 
philosophy  of  we  bought  it,  you  have  to  use  it.  Many  airlines  are  avoiding  this  potential 
problem  by  developing  formal  automation  philosophies  for  pilots.  The  following 
companies  already  have  published  automation  philosophies. 
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Delta 


Delta  Airlines  was  one  of  the  first  major  airlines  to  publish  a  corporate  automation 

pohcy.  Chapter  4  of  the  Delta  flight  operations  manual  states: 

Automation  is  provided  to  enhance  safety,  reduce  pilot  workload  and  improve 
operational  capabilities.  Automation  should  be  used  at  the  most  appropriate  level. 
Pilots  will  maintain  proficiency  in  the  use  of  all  levels  of  automation  and  the  skill 
required  to  shift  between  levels  of  automation.  The  level  used  should  permit  both 
pilots  to  maintain  a  comfortable  workload  distribution  and  maintain  situational 
awareness.  (Bluecoat  Newsgroup,  1997) 

The  following  guidelines  apply  to  the  use  of  automation  at  Delta  Airhnes: 

•  If  any  autoflight  system  is  not  operating  as  expected,  disengage  it. 

•  All  pilots  should  be  aware  of  all  settings  and  changes  to  automation  systems. 

•  Automation  tasks  should  not  interfere  with  outside  vigilance. 

•  Briefings  should  include  special  automation  duties  and  responsibilities. 

•  The  pilot  flying  (PF)  must  compare  the  performance  of  the  autoflight  systems  with 
the  flight  path  of  the  aircraft. 

•  When  a  pilot  conducts  a  briefing,  the  level  of  automation  will  be  addressed. 
(Bluecoat  Newsgroup,  1997) 

Delta  provides  a  four-hour  course  called  introduction  to  automated  aircraft  (IA2) 
to  all  pilots  that  transition  to  glass  cockpit  aircraft.  The  class  teaches  this  automation 
philosophy  and  includes  accident  and  incident  discussions  related  to  automation. 


Cathay  Pacific  Airways 

Cathay  Pacific  Airways  (CPA)  has  been  operating  for  51  years  as  a  private  airline 

based  in  Hong  Kong.  CPA  has  over  60  widebody  aircraft,  1400  cockpit  crew,  4500  cabin 

crew,  and  15,000  employees.  CPA  insists  that  pilots  not  feel  pressured  to  use  automation 

at  all  times.  This  airline  found  it  advantageous  to  provide  a  clear  policy  to  crews: 

It  is  the  Cathay  Pacific  Airways  (CPA)  Policy  to  regard  automation  as  a  tool  to  be 
used,  but  not  blindly  rehed  upon.  At  all  times,  flight  crew  must  be  aware  of  what 
automation  is  doing,  and  if  not  understood  or  not  requested,  reversion  to  basic  modes 
of  operation  should  be  made  immediately  without  analysis  or  delay.  Trainers  must 
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ensure  that  all  CPA  Flight  Crew  are  taught  with  emphasis  on  how  to  quickly  revert  to 
basic  modes  when  necessary.  In  the  man-machine  interface,  man  is  still  in  charge. 
(Bluecoat  Newsgroup,  1997) 

Cathay  Pacific  Airways  believes  if  trainees  are  provided  the  designer's  philosophy, 
preconceived  mind  sets  can  be  overcome  and  knowledge  can  be  acquired  faster.  Pilots 
are  generally  inquisitive  and  want  to  know  as  much  about  a  system  as  possible.  CPA 
attempts  to  satisfy  this  curiosity  by  answering  the  question  why?  CPA  provides  a  video 
to  new  trainees  which  features  a  design  test  pilot's  complete  explanation  for  the 
automation  used  (CRM  Developers  Group,  1997). 

United 

In  1995  United  Airlines  revised  its  pilot  training  philosophy  to  a  consistent, 
mission-oriented  approach  that  tends  to  be  more  compatible  with  highly  automated 
aircraft  (Hughes,  et.  al,  Feb,  95,  p.  50).  United  has  taken  the  approach  that  pilots  don’t 
need  to  know  the  systems  as  well  as  they  had  in  the  past.  Since  most  aircraft  today 
automatically  diagnose  and  correct  malfunctions,  then  inform  the  pilot  of  the  system’s 
status.  United  believes  that  good  systems  knowledge  is  unnecessary  for  pilots.  United 
stresses  cockpit  discipline  and  following  rigid  standard  operating  procedures  (SOPs). 
These  SOPs  include  announcing  changes  in  the  status  of  the  autopilot  and  system  modes. 
United  aims  at  teaching  interfacing  with  the  aircraft  systems  through  the  Flight 
Management  System  (FMS). 

S.  William  Reichert,  United’s  manager  of  fleet  operations  for  the  A320,  and 
B737-200  through  400  series,  says  that  the  key  to  automation  is  awareness.  He  states  that 
operating  these  aircraft  is  more  a  matter  of  systems  management  than  actually  flying  the 
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aircraft  (Hughes  et.  al,  Feb,  1995,  p.  51).  United’s  pilots  are  trained  to  follow  handbook 
operations,  and  would-be  systems  experts  are  discouraged  from  taking  nonstandard 
actions.  This  philosophy  is  different  from  the  military  philosophy  of  understanding 
intricately  how  the  system  works  so  you  are  better  prepared  to  react  to  fix  any  problems 
that  may  occur  that  might  not  be  in  the  flight  manual. 


C-17  Operating  Philosophy 

The  C-17  Operations  are  guided  by  Multi  Command  Instruction  (MCI)  11-217. 
Section  A,  General  Operating  Policies  provides  the  following  guidance  as  the  official 
philosophy  of  the  Air  Force  toward  operating  the  C-17: 


The  C-17A  is  designed  to  be  operated  by  three  crew  members,  two  pilots  and  one 
loadmaster.  In  order  to  perform  the  same  demanding  worldwide  strategic  and  theater 
missions  currently  flown  with  larger  crews,  automation  is  employed.  All  technical 
orders,  procedures,  checklists,  training,  and  supporting  documents  are  designed  to 
support  the  human  operator.  It  is  the  responsibility  of  the  crew  to  fully  understand 
the  operations  and  limitations  of  the  automation  on  the  aircraft.  In  flight,  the  pilot 
flying  (PF)  will  determine  the  most  desirable  level  of  automation  for  a  given 
situation.  (MCI  11-217,  p.  2) 

MCI  11-217  also  provides  the  following  operating  guidelines: 


•  The  aircraft  commander  (AC)  has  the  ultimate  responsibihty  and  authority  for  the 
safety  of  the  aircraft,  passengers,  and  crew. 

•  The  AC  must  manage  workload,  set  priorities  and  employ  the  available  resources, 
including  automation,  to  maintain  overall  situational  awareness. 

•  Us  appropriate  levels  of  automation  as  required  by  the  flight  conditions.  As  the 
flight  situation  changes,  do  not  feel  locked  into  a  level  of  automation. 

The  Instruction  also  points  out  the  following  common  pitfalls  associated  with 

over-reliance,  misuse,  or  misunderstanding  of  automation: 
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•  Fixating  on  the  automation 

•  Misprioritizing  programming  tasks 

•  Mode  Awareness 

•  Assuming  automation  is  programmed  correctly. 

•  Over-reliance  on  automation 

In  addition,  the  instruction  provides  a  discussion  about  standard  terminology  for 
operating  the  Automatic  Flight  Control  System  (AFCS),  including  examples  of 
commands  and  recommended  abbreviations. 

In  general,  the  Air  Force  expects  the  C-17  aircrew  to  let  the  aircraft  perform 
automatically  to  the  maximum  extent  possible.  The  Air  Force  beheves  this  will  decrease 
the  workload  of  the  pilots,  allowing  them  to  manage  the  mission  more  effectively. 
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V.  Automation  Pitfalls 


Aircraft  designers  attempt  to  anticipate  difficulties  and  dangers  associated  with 
the  aircraft  and  incorporate  solutions  into  the  design.  If  they  are  unsuccessful,  the 
operators  of  the  aircraft  will  include  a  warning  or  caution  to  avoid  the  known  hazard. 
However,  with  all  systems  there  are  intrinsic  dangers,  or  pitfalls,  that  the  operator  must 
remain  cognizant  of,  and  make  an  every  effort  to  avoid.  This  section  of  the  paper 
identifies  pitfalls  associated  with  automated  aircraft  that  all  operators  should  seek  to 
avoid. 

In  two  series  of  questions  conducted  four  years  apart,  Capt  Harry  W.  Orlady,  a 
retired  United  Air  Lines  pilot,  sought  to  identify  some  of  the  controversies  associated 
with  the  "glass  cockpit.”  He  identified  a  number  of  controversies  among  pilots: 

1)  The  real-life  workload  that  exists  under  normal,  abnormal  and  emergency 
conditions 

2)  The  role  of  the  pilot  in  these  new  aircraft,  including  maintenance  of  the  captain's 
authority 

3)  The  existence  and,  much  more  important,  the  operational  consequences  of  fatigue, 
boredom  and  complacency  that  might  be  caused  by  these  aircraft.  (Orlady,  1992) 

Workload 

One  of  the  stated  promises  of  incorporating  automation  into  the  cockpit  is  that  it 
will  decrease  pilot  workload  and  allow  more  time  for  decision  making.  After  more  than  a 
decade  of  experience,  this  promise  is  still  largely  unfulfilled.  Earl  L.  Wiener,  professor  of 
management  science  at  the  University  of  Miami,  surveyed  200  line  pilots  from  two 
airlines  flying  Boeing  757  aircraft.  While  the  majority  of  pilots  expressed  pride  in  flying 
the  most  advanced  aircraft  in  their  company's  fleet,  at  least  half  said  they  felt  automation 
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actually  increases  workload  and,  one  year  later,  these  pilots  showed  no  shift  in  their 
opinion. 

While  some  believe  automation  may  have  reduced  pilot  workload,  studies  show 
automation  may  have  merely  redistributed  workload  (Hughes,  et.  al,  1992,  p.  67).  For 
example,  pilots  of  older  aircraft  are  manually  tasked  to  operate  the  controls  as  they  fly, 
while  they  are  cognitively  tasked  to  communicate,  process  information  and  make  a 
decision.  The  pilots  of  newer,  automated  aircraft,  performing  the  same  funetions,  are 
more  cognitively  tasked  to  receive  information,  identify  and  then  input  that  information 
into  the  appropriate  FMS  sub-menu  and  engage  the  automation  to  perform  the  desired 
task.  Depending  on  how  workload  is  measured,  either  one  of  these  situations  could  be 
determined  to  be  more  or  less  intensive  than  the  other.  The  former  manual  proeess 
clearly  is  more  physically  demanding,  but  the  latter  example  of  determining  which  sub¬ 
menu  is  appropriate  for  the  function  being  accomplished,  finding  it,  and  inputting  the 
appropriate  information  is  significantly  more  cognitively  demanding.  Degani  and  Wiener 
found  high,  manual  workload  associated  with  fatigue  and  the  monitoring  of  automatic 
systems  responsible  for  complacency  and  boredom.  This  continuum  is  graphically 
depicted  in  Figure  3. 
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Figure  3:  Monitor  and  Control  Functions  Across  the  Workload  Continuum 
(Billings,  1996,  p.  183) 


Current  research  has  actually  identified  an  increase  of  pilot  workload.  Degani  and 
Wiener  found  that  most  workload  reductions  occur  when  work  levels  were  already  low, 
such  as  during  cruise  (BiUings,  1996,  p.  139).  The  many  changes  experienced  during  the 
historically  high  workload  situations,  such  as  departure  and  arrival,  can  actually  increase 
crew  activity  in  highly  automated  aircraft.  Because  pilots  are  forced  to  focus  their 
attention  inside  the  aircraft  to  perform  these  changes  they  are  not  able  to  look  outside  for 
possible  conflicts. 


Captain’s  Role 

The  traditional  role  of  Captain  being  in  command  of  his  aircraft  is  challenged  by 
automation.  As  discussed  previously  (see  Figure  2)  the  increase  in  technology  over  the 
years  has  distanced  pilots  from  actual  control  of  their  environment.  Also,  the  sometimes 
laborious  FMS  entries  require  that  the  pilot  not  flying  (PNF),  usually  the  first  officer, 
make  changes  to  the  flight  profile,  while  the  pilot  flying  (captain)  monitors  the  aircraft. 
By  ultimately  affecting  the  course  of  the  aircraft  the  PNF,  in  essence,  becomes  the  PF. 
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This  shared  control  of  the  aircraft  weakens  and  blends  estabhshed  cockpit  roles  and  may 
lead  to  confusion  about  who  is  actually  in  control  of  the  aircraft. 

Pilots  can  play  any  of  a  variety  of  roles  in  the  control  and  management  of  a  highly 
automated  airplane.  These  roles  range  from  direct  manual  control  of  flight  path  and 
aircraft  systems  to  a  largely  autonomous  operation  in  which  the  pilot’s  active  role  is 
minimal.  This  allocation  of  functions  is  represented  in  the  following  control-management 
continuum  (Table  1)  by  Dr.  Charles  Billings: 
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1  Manaaement  Mode 

Automation  Functions 

Human  Functions 

Fully  autonomous  operation 

Pilot  not  usually  informed 

System  may  or  may  not  bo 
capable  of  beino  disabled 

Pilot  generally  has  no  role  inoperating 
Monitoring  is  limited  to  fault  detection 
Goals  are  self-defined;  pilot  normally 
has  no  reason  to  intervene 

s 

Essentially  autonomous  operation 
Automatic  reconfiguration 

System  Informs  pilot  and 
monitors  resoonses 

Pilot  informed  of  system  intent; 

Must  consent  to  critical  decisions; 

May  Intervene  by  reverting  to  lower 
level  of  manaaement 

Full  automatic  control  of 
aircraft  and  flight 

Intent,  diagnostic  and 
oromotino  functions  provided 

Pilot  must  consent  to  state  changes, 
checklist  execution,  anomaly 
resolution; 

Manual  execution  of  critical  actions 

Enhanced  control  and  guidance; 
Smart  advisory  systems; 

Potential  flight  path  and  other 
predictor  displays 

Pilot  in  control  through  CWS  or 
envelope-protected  system; 

May  utilize  advisory  systems; 

System  manaaement  manual 

Flight  director,  FMS,  nav  modules; 
Data  link  with  manual  mesages; 
Monitoring  of  flight  path  control 
and  aircraft  systems 

Direct  authority  over  all  systems; 

Manual  control,  aided  by  F/D  and 
enhanced  navigation  displays; 

FMS  is  availabe;  trend  info  on  reauest 

Normal  warnings  and  alerts' 

Voice  communication  with  ATC; 
Routine  ACARS  communications 
performed  automatically 

Direct  authority  over  all  systems; 

Manual  control  utilizing  raw  data; 

Unaided  decision-making; 

Manual  communications 

A  pilot  must  be  able  to  operate  the  aircraft  as  necessary  for  safe  flight.  As  previously 
discussed,  Airbus  A320  designers  have  limited  the  amount  of  direct  control,  preventing 
manual  inputs  that  exceed  pre-determined  parameters.  The  A320  is  only  one  example 
where  designers  have  hmited  the  pilots  operating  parameters  from  the  design  bench. 
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Complacency 

Crew  complacency  is  often  mentioned  as  one  potential  negative  effect  of 
automation.  The  theory  is  that  as  pilots  perform  duties  as  systems  monitors  they  will  be 
lulled  into  complacency,  lose  situational  awareness,  and  not  be  prepared  to  react  in  a 
timely  manner  when  the  system  fails.  Wiener  (1981)  defined  complacency  as  "a 
psychological  state  characterized  by  a  low  index  of  suspicion."  In  the  NASA  Aviation 
Safety  Reporting  System  (ASRS)  coding  manual,  complacency  is  defined  as  "self- 
satisfaction  which  may  result  in  non- vigilance  based  on  an  unjustified  assumption  of 
satisfactory  system  state"  (Parasuraman,  et.  al,  1993). 

Parasuraman,  Molloy,  and  Singh  (1993)  indicated  that  the  major  factors 
contributing  to  "complacency  potential"  were  a  person’s  trust  in,  rehance  on,  and 
confidence  in  automation.  Crew  attitudes  such  as  overconfidence  in  automation  may  not 
be  sufficient  in  themselves  to  lead  to  complacency  but  may  only  indicate  a  potential  for 
complacency.  Parasuraman,  Molloy  and  Singh  propose  that  complacent  behavior  may 
arise  only  when  complacency  potential  occurs  jointly  with  other  conditions  such  as  high 
workload  brought  about  by  poor  weather,  heavy  traffic,  or  fatigue  due  to  poor  sleep  or 
long  flights.  The  combination  of  the  crew's  attitude  toward  automation  (e.g., 
overrehance)  and  a  particular  situation  (e.g.,  fatigue)  may  lead  to  complacent  behavior. 

The  dominant  tendency  of  technology-centered  design  has  been  to  reduce  pilot 
workload  and  to  reap  the  benefits  of  economies  such  as  fuel  efficiency  and  reduced 
manning  costs.  The  study  by  Parasuraman,  Molloy  and  Singh  supported  the  position  that 
taking  the  pilot  out  of  the  loop  by  automating  a  function  degrades  system  awareness  and 
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manual  skills,  so  that  the  pilot  may  not  be  able  to  intervene  effectively  if  the  automation 
fails.  The  results  of  this  study  again  add  support  to  Dr,  Billings’  Human-Centered  design 
philosophy. 

Mode  Confusion 

A  flight  management  system  (FMS)  on  an  advanced  aircraft  is  capable  of 
conducting  an  entire  flight  without  the  pilot  flying  the  plane.  To  do  this  the  flight  modes 
will  automatically  transition  from  climb,  to  level  off,  cruise,  descent  and  finally  approach. 
Each  one  of  these  modes  provides  different  input  characteristics  to  the  aircraft,  and  the 
pilot  must  always  be  aware  of  the  operating  mode  to  remain  prepared  to  return  to  manual 
flight.  In  some  aircraft,  keeping  informed  of  this  mode  change  requires  monitoring  a  very 
small  display  on  the  glareshield  of  the  aircraft.  It  is  easy  to  see  at  night,  but  can  be  very 
difficult  to  monitor  in  daylight,  especially  if  the  sun  is  directly  on  the  glareshield.  If  the 
pilot  takes  command  of  the  aircraft  manually  and  assumes  the  aircraft  to  be  in  a  particular 
mode  and  it  is  not,  the  result  could  be  disastrous.  The  Airbus  A300  crash  in  Nagoya, 
Japan,  is  an  example  of  the  pilot  taking  manual  control  of  the  aircraft  when  the  aircraft 
was  on  an  approach.  The  pilot  inadvertently  activated  the  go-around  mode,  which  on  the 
A300  commands  full  power  and  a  rapid  climb  away  from  the  ground.  The  pilot 
attempted  to  continue  the  approach  manually  and  fought  against  the  autopilot,  causing  the 
pitch  trim  to  run  to  the  limit.  The  aircraft  became  uncontrollable  and  crashed. 

A  major  area  of  concern  with  the  rapid  development  of  cockpit  systems  is  that 
technology  has  outpaced  human  ability  to  fully  comprehend  automated  mode  behaviors 
(Hughes,  et  al.,  Jan,  1995,  p.  63).  Barry  Strauch,  Chief,  Human  Factors  Division  at  the 
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National  Transportation  and  Safety  Board  (NTSB),  stated  in  1995  that  “pilot  awareness 
and  understanding  of  computer  modes  in  modem  transport  aircraft  is  a  problem” 

(Hughes,  et.  al,  Jan,  1995,  p.  63).  A  study  of  mode  confusion  was  conducted  by  the 
Massachusetts  Institute  of  Technology  (MIT)  in  1994.  The  Aviation  Safety  Reporting 
System  (ASRS)  was  searched  for  incidents  related  to  mode  confusion.  The  MIT  team 
identified  184  incidents  of  mode  awareness  problems  and  broke  them  down  into  six 
categories  (Hughes,  et.  al,  Jan,  p.  56).  The  six  categories  are  shown  in  Figure  4  and 
described  in  Table  2. 

The  MIT  study  found  that  74%  of  the  incidents  involved  confusion  or  errors  in 
vertical  navigation,  while  26%  were  problems  related  to  horizontal,  or  lateral,  navigation. 
R.  John  Hansman,  an  MIT  professor,  noted  that  newer  aircraft  provide  better  feedback  on 
horizontal  navigation  than  vertical.  Most  advanced  aircraft  are  equipped  with  a  display 
that  overlays  an  electronic  map  of  the  aircraft  route,  including  land  based  navigational 
aids,  with  the  weather.  This  display  provides  a  clear  picture  to  the  pilot  of  where  the 
aircraft  is  going  and  how  it  will  proceed.  By  contrast,  no  such  picture  exists  for  vertical 
navigation  so  the  pilot  must  develop  a  mental  model  of  how  vertical  navigation  is 
affecting  the  flight  path. 
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Figure  4:  Mode  Awareness  Incidents  (Hughes,  et.  al,  Jan,  1995,  p.  56) 

Table  2:  Discussion  of  Error  Categories  from  Mode  Awareness  Study 
_ (Hughes,  et.  al,  Jan,  1995,  p.  56) _ 


Data  Base  Error 

A  FMS  data  base  error  caused  the  crew  to  either  execute  an 
incorrect  procedure,  or  to  question  the  validity  of  the 
automatic  flight  system  (AFS)  commands. 

Mode  Transition 

Flight  crew  confusion  or  aircraft  deviation  because  the  AFS 

problem 

executed  an  unexpected  mode  transition,  or  failed  to  execute 
an  expected  mode  transition. 

Insufficient 

Because  one  or  more  of  the  crew  members  did  not  fully 

understanding  of 
the  automation 

understand  the  consequences  of  an  action  or  inaction, 
confusion  or  a  deviation  occurred. 

Programming  error 

A  partial  or  full  AFS  failure  that  resulted  in  crew  confusion  or 
an  aircraft  deviation. 

Crew  coordination 

Incorrect  data  input  or  mode  selector  that  was  not  identified 
immediately  and  resulted  in  an  unexpected  mode,  mode 
change  or  deviation. 

Unknown  Failure 

Any  sequence  of  events  initiated  by  one  crew  member  that 
caused  one  or  more  of  the  other  crew  members  to  incorrectly 
assume  a  mode,  mode  transition  or  parameter. 
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Hansman  pointed  out  that  vertical  navigation  is  difficult  to  comprehend  because  it 
involves  the  use  of  different  combinations  of  elevator  and  thrust  inputs.  Automated 
systems  are  capable  of  maintaining  an  air  speed,  a  vertical  speed,  or  a  flight  path  angle,  in 
the  climb.  Each  possibility  affects  the  vertical  flight  path  in  a  different  manner. 

To  preclude  mode  confusion,  Barry  A.  Strauch  of  the  NTSB  advocates  a  more 
stringent  pilot  selection  process  coupled  with  advanced  training  standards  that  fully 
expose  pilots  to  the  complex  capabilities  of  current  and  future  glass  cockpits  (Hughes,  et 
al,  Jan,  1995,  p.  63).  In  summary,  Earl  Wiener  points  out  that  although  a  key  function  of 
cockpit  automation  has  been  to  help  eliminate  mistakes,  “it  is  a  fallacy  to  think  that 
automation  removes  human  error  when  it  actually  can  give  the  pilot  opportunities  to  make 
even  larger  mistakes”  (Hughes,  1992).  It  is  the  goal  of  designers,  operators  and 
regulating  agencies  to  minimize  these  opportunities  for  mistakes. 
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VI.  Recommendations 


This  section  of  the  paper  expands  upon  the  philosophy  and  policies  represented  in 
Multi-Command  Instruction  (MCI)  11-217  and  makes  recommendations  that  might  be 
incorporated  into  future  Air  Force  instructions.  These  recommendations  are  based  on  the 
FAA  Human  Factors  (HF)  Team  Report,  Interfaces  Between  Fliehtcrews  and  Modem 
Flight  Deck  Systems  (Abbott,  1996).  These  reconunendations  are  adapted  for  the  unique 
characteristics  of  the  military  mission. 

The  Air  Mobility  Command  provides  an  excellent  operating  policy  to  its  crews. 
This  policy,  found  in  MCI  11-217,  Volume  5,  is  already  in  hne  with  many 
recommendations  from  the  HF  team  report.  The  HF  team  recommends  “that  a  uniform 
set  of  information  regarding  the  manufacturer  and  operator  philosophies  about 
automation  be  explicitly  conveyed  to  flightcrews.”  This  information  should  include  but 
not  be  limited  to: 

•  The  manufacturer’s  higher  level  design  philosophy  (e.g.,  the  reasons  for 
automating  particular  functions)  to  the  extent  that  this  philosophy  could  affect 
operational  use; 

•  The  operator’s  automation  philosophy,  which  should  be  used  as  the  basis  for 
operator  policies,  procedures,  and  practices  related  to  automation  use; 

•  The  principles  of  operation  (e.g.,  operating  assumptions  used  in  the  design,  such  as 
the  basis  for  the  computation  of  vertical  flight  profiles); 

•  A  description  of  the  envelope  protection  features,  including  specific  capabilities 
and  limitations,  and  the  situations  or  flight  conditions  for  which  envelope 
protection  is  or  is  not  available; 

•  Guidance  (including  rationale)  relative  to  selecting  the  appropriate  level  of 
automation  for  routine  use  and  non-routine  situations  (e.g.,  when  confused  by 
automation  response,  engine  failure  in  different  phases  of  flight,  unusual  attitudes, 
speed  excursions  (high  or  low),  terrain  or  collision  avoidance,  flight  path 
deviations,  or  unexpected  or  difficult  air  traffic  clearances  or  requests); 
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•  Standard  operating  procedures  should  be  consistent  with  the  operator’s  automation 
philosophy  for  each  airplane  type  and  should  promote  understanding  of  the 
action(s)  expected  of  the  flightcrew  and  the  automation. 

Although  the  Air  Force  provides  much  information  in  initial  training  and  MCI  11- 
217,  the  Air  Force  should  work  to  provide  better  information  to  crews  about  the 
appropriate  levels  of  automation  for  routine  and  non-routine  use.  Further,  the  Air  Force 
should  establish  standard  design  guidelines  for  future  generation  of  flight  management 
systems.  This  practice  would  minimize  the  effect  of  transitioning  from  one  airframe  to 
another.  The  HF  report  recommends  establishing  industry  guidelines  for  FMS  design  in 
the  following  areas  (Abbott,  1996,  p.  40): 

•  Standardization  of  route,  leg,  and  constraint  conventions  such  as  waypoint  entry 
conventions,  definition,  and  implementation  of  vertical  profiles  (e.g.,  vertical 
navigation),  etc.  to  reduce  error  potential  and  facilitate  an  easier  transition 
between  airplane  types  or  derivatives; 

•  Critical  or  irrevocable  entries  should  be  confirmed  before  they  are  executed,  as 
well  as  providing  an  “undo”  capability  when  appropriate; 

•  Response  time  should  be  improved  when  long  response  times  can  lead  to 
flightcrew  distraction  from  other  essential  tasks  or  cause  programming  errors; 

•  Titles  of  pages  and  relationships  among  different  pages  should  be  clear  and 
unambiguous  so  as  to  facilitate  easy  access  to  information; 

•  Unanticipated  dropping  of  information  (e.g.,  waypoint,  altitude  constraints) 
should  be  addressed  when  it  leads  to  frequent  incorrect  path  definition  or 
excessive  workload  in  using  “workarounds;” 

•  Error  messages  should  be  meaningful  and  helpful  (e.g.,  in  response  to  improper 
entry)  and  assist  the  flightcrew  in  correcting  the  entry  (e.g.,  “invalid  entry”  is 
insufficient,  instead  provide  the  appropriate  format  to  use  or  identify  the 
missing  information). 

Standardization  at  this  point  for  civil  aviation  would  be  both  expensive  and  time 
consuming  due  to  the  significant  number  of  airframe  designs  already  in  existence. 
However,  since  the  Air  Force  is  just  entering  into  the  advanced  aircraft  arena,  this  is  an 
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excellent  opportunity  to  establish  standards  for  future  design  that  will  facilitate 
development. 

Conclusion 

While  at  the  NASA  Ames  Research  Center,  Dr.  Charles  Billings  said, 
"Automation  is  there  to  use,  but  it  must  be  as  simple  to  manage  as  the  aircraft  is  to  fly” 
(Orlady,  1992).  This  seems  to  be  the  root  of  current  problems  in  aviation.  Unfortunately, 
early  automation  was  implemented  in  the  cockpit  on  the  implicit  assumption  that 
machines  could  be  substituted  for  humans.  The  theory  of  “if  it  can  be  automated,  do  it” 
pervaded  the  industry.  In  the  past  ten  years  we  have  seen  the  limitations  of  this  theory; 
the  pilot  becomes  increasingly  removed  from  the  operation  of  the  aircraft. 

This  paper  provided  a  discussion  of  automation  and  presented  philosophies  that 
exist  in  the  aviation  industry  today.  Whether  it  is  a  cultural  or  economic  coincidence  or 
with  forethought  and  intention,  the  automation  philosophy  of  the  European  consortium. 
Airbus,  is  significantly  different  from  that  of  American  airhne  manufacturers.  The  result 
is  different  courses  of  action  and  different  cognitive  processing  of  what  each  aircraft  wiU 
or  will  not  do  automatically.  Obviously  these  significant  differences  can  result  in  serious 
consequences  when  moving  from  one  aircraft  type  to  another.  This  is  an  important 
concept  for  the  Air  Force  to  embody;  today  the  Air  Force  is  in  the  process  of  purchasing  a 
second  advanced  cockpit  transport  aircraft,  the  Lockheed  C-130J,  from  a  different 
manufacturer  than  the  C-17.  It  is  logical  to  assume  that  individuals  qualified  in  one 
airframe  may  eventually  transition  to  the  other.  If  both  aircraft  operate  on  similar 
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philosophies  then  that  transition  will  be  made  easier  and  faster.  The  shorter  training 
period  will  result  in  lower  training  costs  to  the  Air  Force. 

The  philosophies  of  civilian  airline  companies  presented  in  this  paper  were  the 
only  ones  available  to  the  author.  Other  airlines  may  publish  philosophies,  but  only  the 
stated  few  were  willing  or  able  to  share  their  philosophies.  The  Air  Force  should  stay 
informed  of  civilian  philosophies  and  further  develop  current  philosophies  to  enhance 
flightcrew  understanding  and  facilitate  development  of  future  designs.  The  FAA  Human 
Factors  Team  recommends  that  all  operators  and  designers  establish  automation 
philosophies  in  a  formal  statement.  By  stating  the  philosophy,  operators  and  designers 
provide  a  valuable  foundation  for  flightcrews  to  understand  the  automation.  A  better 
understanding  will  facilitate  operations  and  may  avoid  some  of  the  incidents  and 
accidents  described  in  Appendix  A  of  this  report.  By  establishing  a  philosophy  of  its 
own,  the  Air  Force  is  well  on  its  way  to  continued  success  with  the  C- 17  and  future 
aircraft  designs. 
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Appendix  A  :  Automation  Incidents  and  Accidents 


Date 

Location 

Airplane 

Operator 

Description 

Type 

12/29/72 

Miami 

L-1011 

Eastern 
Air  Lines 

Flightcrew  members  became 
immersed  in  an  apparently 
malfunctioning  landing  gear. 

Airplane  was  in  control  wheel 
steering  mode.  Altitude  hold 
inadvertently  disengaged  by  a  light 
force  on  the  control  wheel.  Altitude 
alert  aural  warning  not  heard  by 
flightcrew.  Fatal  crash. 

Boston 

DC-9-31 

Delta  Air 
Lines 

Airplane  landed  short  during  an 
approach  in  fog.  Flightcrew  was 
preoccupied  with  questionable 
information  presented  by  the  flight 
director.  Fatal  crash. 

2/28/84 

New  York 

DC-10-30 

Scandin¬ 

avian 

Airlines 

Malfunctioning  autothrottle  system 
during  approach  resulted  in  crossing 
the  runway  threshold  at  50  knots 
above  reference  speed.  Runway  was 
wet,  touchdown  was  4700  feet 
beyond  the  threshold  of  an  8400  foot 
runway.  Airplane  overran  runway, 
minor  injuries.  Complacency  and 
over-reliance  on  automatic  systems 
cited. 

2/19/85 

San 

Francisco 

747SP 

China 

Airlines 

Loss  of  power  on  one  engine  during 
autoflight.  Autopilot  tried  to 
compensate  until  control  limits  were 
reached.  Captain  disengaged 
autopilot,  airplane  went  into  unusual 
attitude  high  speed  dive,  but  was 
successfully  recovered.  Autopilot 
masked  approaching  onset  of  loss  of 
control. 
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Date 

Location 

Airplane 

Operator 

Description 

Type 

6/26/88 

Habsheim 

A320 

Air 

France 

Low,  slow  flyover  at  air  show.  Ran 
out  of  energy  and  flew  into  trees. 
Possible  overconfidence  in  the 
envelope  protection  features  of  the 
A320.  Fatal  crash. 

7/3/88 

Gatwick 

A320 

unknown 

Programmed  for  3  degree  flight  path, 
but  inadvertently  was  in  vertical 
speed  mode,  almost  landed  3  miles 
short. 

1/89 

Helsinki 

A300 

KARAir 

While  making  an  ILS  approach,  the 
takeoff/go-around  lever  was 
inadvertently  depressed.  In  response 
to  the  unexpected  and  sudden  nose-up 
change  in  the  airplane’s  attitude,  the 
flightcrew  immediately  reacted  by  re¬ 
trimming. 

6/8/89 

Boston 

767 

unknown 

On  autopilot  ILS  approach,  airplane 
overshot  the  localizer.  Captain 
switched  from  approach  to  heading 
select  mode  to  regain  the  localizer , 
disengaged  the  autopilot,  and  used  the 
flight  director.  Since  the  glide  slope 
had  not  been  captured,  the  flight 
director  was  in  vertical  speed  mode 
commanding  an  1,800  fpm  rate  of 
descent.  Alert  from  the  ground 
proximity  warning  and  tower  resulted 
in  a  go-around  from  about  500  feet. 

2/14/90 

Bangalore 

A320 

Indian 

Airlines 

Inappropriate  use  of  open  descent 
mode.  Fatal  crash. 

6/90 

San  Diego 

A320 

unknown 

Pilot  mistakenly  set  vertical  speed  of 
3,000  fpm  instead  of  3.0  degree  flight 
path  angle.  Error  was  caught,  but 
airplane  descended  well  below  profile 
and  minimum  descent  altitude. 

39 


Location  Airnlane  Onerator 


Type 


1/20/92  Strasbourg  A320  Air  Inter 


9/14/93  Warsaw 


Lufthansa 


Description 


Pilot  intervention  in  auto-pilot 
coupled  go-around  resulted  in  the 
autopilot  commanding  nose-up  trim 
while  the  pilot  was  applying  nose- 
down  elevator.  Autopilot 
disconnected  when  mode  transitioned 
to  altitude  acquire  mode  -  force 
disconnect  not  inhibited  in  this  mode 
as  it  is  in  go-around  mode.  Airplane 
ended  up  badly  out  of  trim  and  went 
through  several  extreme  pitch 
oscillations  before  the  flightcrew 
regained  control. 


Evidence  suggests  flightcrew 
inadvertently  selected  3,300  fpm 
descent  rate  on  approach  instead  of 
3.3  degree  flight  path  angle.  Fatal 
crash. 


Wet  runway,  high  tailwinds  -  After 
touchdown,  the  air/ground  logic  did 
not  indicate  the  airplane  was  on  the 
ground,  and  delayed  deployment  of 
ground  spoilers  and  reversers. 
Airplane  overran  runway.  Two 
fatalities. 


Date  Location  Airplane  Operator  Description 


9/13/93  Tahiti  747-400  Air  VNAV  approach  with  autothrottle 

France  engaged,  autopilot  disengaged.  Upon 


reaching  the  published  missed 
approach  point,  VNAV  commanded  a 
go-around  and  the  autothrottle 
advanced  power.  After  a  delay,  the 
flightcrew  manually  reduced  power  to 
idle  and  held  the  thrust  levers  in  the 
idle  position.  The  airplane  landed 
long  and  fast.  Two  seconds  prior  to 
touchdown  the  number  one  engine 
thrust  lever  advanced  to  nearly  full 
forward  thrust  and  remained  there 
until  the  airplane  stopped.  Reverse 
thrust  was  obtained  on  the  other 
engines.  The  spoilers  were  not 
deployed  —  the  automatic  system  did 
not  operate  because  the  number  one 
thrust  lever  was  not  at  idle,  and  the 
flightcrew  did  not  extend  them 
manually.  The  flightcrew  lost 
directional  control  of  the  airplane  as 
the  speed  decreased  and  the  airplane 
went  off  the  right  side  of  the  runway. 
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Location  Airplane  Operator 


Type 


Description 


Dragonair  After  three  missed  approaches  due  to 
lateral  oscillations  in  turbulent 
conditions,  a  landing  was  made  and 
the  airplane  went  off  the  side  of  the 
runway.  The  flaps  locked  at  40 
degrees  deflection  (landing  position) 
just  before  the  first  go-around  due  to 
asynunetry.  Asymmetry  caused  by 
rigging  at  the  design  tolerance 
combined  with  gust  loads 
experienced.  In  accordance  with 
published  procedures,  flightcrew 
selected  CONF  3  for  landing,  which 
extended  slats  to  22  degrees.  With 
autopilot  engaged,  lateral  control  laws 
correspond  to  control  lever  position. 
Under  manual  control,  control  laws 
correspond  to  actual  flap/slat  position. 
The  configuration  CONF  3,  with  flaps 
locked  at  40  degrees,  is  more 
susceptible  to  lateral  oscillations  with 
the  autopilot  engaged.  After  a  similar 
incident  in  November,  1993, 
experienced  by  Indian  Airlines, 

Airbus  issued  an  Operations 
Engineering  Bulletin  to  leave  the 
control  lever  in  CONF  FULL  if  the 
flaps  lock  in  that  position. 


Date  I  Location  Airplane  Operator 


Type 


China 

Airlines 


6/21/94  Manchester  757-200  I  Britannia 


6/30/94  Toulouse 


Airbus 


Description 


Flightcrew  inadvertently  activated  the 
go-around  switches  on  the  throttle 
levers  during  a  manually  flown 
approach.  This  action  engaged  the 
autothrottles  and  put  the  flight 
guidance  system  in  go-around  mode. 
Flightcrew  disconnected  the 
autothrottles,  but  excess  power 
caused  divergence  above  the  glide 
slope.  Flightcrew  attempted  to  stay 
on  glide  slope  by  commanding  nose- 
down  elevator.  The  autopilot  was 
then  engaged,  which  because  it  was 
still  in  go-around  mode,  commanded 
nose-up  trim.  Flightcrew  attempted 
go-around  after  “alpha  floor” 
protection  was  activated,  but 
combination  of  out-of-trim  condition, 
high  engine  thrust,  and  retracting  the 
flaps  too  far  led  to  a  stall.  Fatal  crash. 


Altitude  capture  mode  activated 
shortly  after  takeoff,  autothrottles 
reduced  power,  flight  director 
commanded  pitch-up  before 
disappearing.  Airspeed  dropped 
toward  V  2  before  flightcrew  pitched 
the  nose  down  to  recover. 


Unexpected  mode  transition  to 
altitude  acquire  mode  during  a 
simulated  engine  failure  resulted  in 
excessive  pitch,  loss  of  airspeed,  and 
loss  of  control.  Pitch  attitude 
protection  not  provided  in  altitude 
acquire  mode.  Fatal  crash. 


Date  Location  Airplane  I  Onerator 


Type 


American 

Eagle 


Description 


Overshoot  of  flap  placard  speed 
during  approach  caused  a  mode 
transition  to  flight  level  change. 
Autothrottles  increased  power  and 
trim  went  full  nose-up  for  unknown 
reasons  (autopilot  not  engaged). 
Flightcrew  attempted  to  stay  on  path 
by  conunanding  nose-down  elevator, 
but  could  not  counteract  effect  of 
stabilizer  nose-up  trim.  Airplane 
stalled,  but  was  recovered. 


In  a  holding  pattern,  the  airplane  was 
exposed  to  a  complex  and  severe 
icing  environment,  including  droplet 
sizes  much  larger  than  those  specified 
in  the  certification  requirements  for 
the  airplane.  During  a  descending 
turn  immediately  after  the  flaps  were 
retracted,  the  ailerons  suddenly 
deflected  in  the  right-wing  down 
direction,  the  autopilot  disconnected, 
and  the  airplane  entered  an  abrupt  roll 
to  the  right.  The  flightcrew  were 
unable  to  correct  this  roll  before  the 
airplane  impacted  the  ground. 


Date  Location  Airnlane  Onerator 


Type 


Bradley 

International 

Airport 


American 

Airlines 


Description 


Shortly  after  takeoff  in  poor  visibility 
and  heavy  snow,  with  autothrottles 
engaged,  climb  thrust  was  selected. 
The  right  engine  throttle  jammed  and 
remained  at  takeoff  thrust,  while  the 
left  engine  throttle  slowly  reduced  to 
idle.  The  increasing  thrust  asymmetry 
resulted  in  an  increasing  left  bank 
angle,  which  eventually  reached  about 
170  degrees.  The  airplane  lost 
altitude  and  impacted  the  ground  at  an 
80-degree  angle.  Only  small  rudder 
and  elevator  deflections  were  made 
until  seconds  before  impact,  when  the 
left  throttle  was  brought  back  to  idle 
to  remove  the  thrust  asymmetry. 

Fatal  crash. 


On  a  VOR-DME  approach,  the 
airplane  descended  below  the 
minimum  descent  altitude,  clipped 
some  trees,  and  landed  short  of  the 
runway.  Contributing  to  this  incident 
was  a  loss  of  situation  awareness  and 
terrain  awareness  by  the  flightcrew, 
lack  of  vertical  guidance  for  the 
approach,  and  insufficient 
conununication  and  coordination  by 
the  flightcrew. 


Date 

Location 

Airplane 

Type 

Operator 

Description 

12/20/95 

Cali 

757-200 

American 

Airlines 

Unexpectedly  cleared  for  a  direct 
approach  to  Cali,  the  flightcrew 
apparently  lost  situation  awareness 
and  crashed  into  a  mountain  north  of 
the  city.  On  approach,  the  flightcrew 
were  requested  to  report  over  Tulua 
VOR.  By  the  time  this  waypoint  was 
input  into  the  flight  management 
computer,  the  airplane  had  already 
flown  past  it;  the  autopilot  started  a 
turn  back  to  it.  The  flightcrew 
intervened,  but  the  course  changes  put 
them  on  a  colhsion  course  with  a 
mountain.  Although  the  ground 
proximity  warning  system  alerted  the 
flightcrew,  and  the  flightcrew 
responded,  they  neglected  to  retract 
the  speedbrakes  and  were  unable  to 
avoid  hitting  the  mountain.  Fatal 
crash. 

ime 

Puerto  Plata 

757-200 

Birgenair 

After  taking  off  from  Puerto  Plata,  the 
flightcrew  lost  control  of  the  airplane 
during  chmb  and  crashed  into  the 
ocean  off  the  coast  of  the  Dominican 
Republic.  Problems  with  the 
captain's  airspeed  indication  were 
encountered  during  the  takeoff  roll, 
and  the  takeoff  and  initial  climbout 
were  conducted  using  airspeed 
callouts  by  the  first  officer. 

Continued  erroneous  airspeed 
indications,  possibly  due  to  a  blocked 
pitot  tube,  resulted  in  an  overspeed 
warning  during  climb.  Shortly 
thereafter  the  stickshaker  activated. 

The  conflicting  warnings  (overspeed 
and  stall)  apparently  confused  the 
flightcrew.  The  airplane  entered  a 
stall  from  which  it  did  not  recover. 

Fatal  crash. 
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This  paper  discusses  automation  philosophies  of  aircraft  manufacturers  and 
operators,  including  the  philosophies  employed  in  the  McDonnell  Douglas  C-17 
Globemaster  III.  Automation  philosophy  is  defined  and  a  human-centered  automation 
philosophy  advanced  by  Dr.  Charles  Billings  is  presented  as  the  leading  approach  to 
future  aircraft  designs.  Additionally,  a  discussion  of  some  of  the  dangers  and  difficulties 
associated  with  the  operation  of  automated  aircraft  are  presented  in  an  effort  to  enlighten 
Air  Force  aircrews  of  pitfalls  associated  with  this  new  technology. 

With  the  acquisition  of  the  C-17  the  Air  Force  has  inaugurated  a  new  generation 
of  airlift  aircraft.  More  than  just  replacing  the  C-141  as  the  workhorse  of  the  Air  Force, 
the  C-17  has  also  replaced  part  of  the  crew  with  inertial  navigation  systems,  computers, 
and  automation.  The  reliance  on  the  automation  of  the  C-17  demands  a  smooth  interface 
between  crew  and  automation.  This  paper  expounds  on  the  existing  philosophies  found 
in  Multi-Command  Instruction  (MCI)  11-217  and  provides  recommendations  to  future 
instructions.  These  recommendations  are  adapted  from  an  FAA  report  discussing 
interfaces  between  flightcrews  and  modem  flight  decks.  Finally,  prior  accidents  and 
incidents  associated  with  automation  are  presented  in  the  appendix  to  the  paper. 


